ArteraAI

The model is the test. The ArteraAI Prostate Test reads digital images of a biopsy the patient already had, combines them with the patient's clinical data, and returns a risk estimate; there is no assay, no additional tissue and no separate laboratory chemistry.

The company describes models developed on data from thousands of patients and tens of thousands of slide images from phase 3 randomized trials, and the FDA authorized software version (DEN240068) takes H and E whole slide images and returns 10 year risks of distant metastasis and prostate cancer specific mortality. Remove the model and nothing remains to sell.

The system informs and does not decide, and what happens when the score is wrong is not published. The test returns a risk estimate and, for intermediate risk patients, a prediction of benefit from short term androgen deprivation therapy; NCCN positions it for use in addition to NCCN risk category, individual characteristics and patient preference, and the FDA authorized version's labeling says it complements a standard of care evaluation and may fail in some scenarios. Cut points are published, tying the score to roughly 3 and 10 percent ten year risk of distant metastasis, so the thresholds that change a recommendation are visible.

The part missing is the failure side: no statement of how often a patient lands on the wrong side of a cut point, what a clinician should do with a result near a threshold, or how the company handles a reported misclassification.

The oversight structure is described with the error handling missing.

What is under the hood is named, the training data is characterized, and change is governed by a published plan. The model is a multimodal AI developed on data from thousands of patients and tens of thousands of slide images from phase 3 randomized trials with up to 15 years of follow up; the algorithm is described as pre established and locked at a stated version (1.2 in the company's material), so a published result attaches to a specific model. Inputs are enumerated (digital biopsy images, with age, PSA and tumor stage in the laboratory test), and the output is a continuous score from 0 to 1 with cut points tied to roughly 3 and 10 percent ten year risk. The FDA authorized software (DEN240068, 31 July 2025) takes H and E whole slide images from FDA cleared interoperable scanners, and its Predetermined Change Control Plan sets out how further scanners are added without a new submission, which is published update discipline for the one change the plan allows.

What a buyer cannot see is the architecture itself and how revisions to the laboratory test's model are announced.

The chain is structurally short. The test runs in the company's own CLIA certified laboratory in Jacksonville on the company's own authorized, locked model, which cannot be quietly swapped for another supplier's (the authorization's change control plan covers adding scanners only), and the security page names AWS as the cloud host. No outside model provider sits in the path, and the ordering provider's images and clinical data go to Artera rather than through a platform partner.

What is not published is the party list: no subprocessor list appears on the security page, and the trust center (trust.artera.ai) offers documentation on request. The Notice of Privacy Practices requires the company's business associates to protect health information without naming them, and permits de-identified data to be used and disclosed without a stated limit on purpose, so who receives de-identified material is open.

An in house model and laboratory with the host named.

Guideline inclusion resting on randomized trial validation. The test is included in the NCCN Clinical Practice Guidelines for Prostate Cancer, which the company describes as the first and only AI test in them, with a Level 1B evidence rating under Simon criteria and a Category 2A recommendation.

The models were developed and validated on multiple phase 3 randomized trials from NRG Oncology and RTOG with up to 15 years of follow up; the company's test page reports the predictive result for short term androgen deprivation therapy (biomarker positive HR 0.34, 95 percent CI 0.19 to 0.63, n = 673; biomarker negative HR 0.92, CI 0.59 to 1.43, n = 1,046), and published results show a 9.2 to 14.6 percent relative improvement over NCCN standard methods at a median 11.4 years.

An independent validation in a real world prostatectomy cohort and an external validation in a Singapore cohort have been published, as has a cost effectiveness analysis in a JNCI journal by a UCLA group unaffiliated with the company; post prostatectomy performance was validated in NRG/RTOG trial cohorts (European Urology). A guideline panel evaluates the evidence rather than the marketing, which is a higher bar than a vendor claim.

Documented on use and disclosure, incomplete on the lifecycle. The company's HIPAA Notice of Privacy Practices, linked in the footer, sets out who receives protected health information and why, requires patient authorization for marketing or any disclosure amounting to a sale, and gates research disclosure behind approval by an institutional review or privacy board; patients can obtain an accounting of disclosures. The security page states AES-256 encryption at rest and encryption in transit on AWS. One architectural feature does real work: the model is locked at a stated version, so cases submitted for testing do not retrain the model that produced the result.

What is absent is the rest of the lifecycle. No retention period is published for digitized slide images or the accompanying clinical data, no deletion position is stated, and the notice permits use and disclosure of de-identified information with no limit on purpose, which is where any future model development would sit; nothing says whether it does. Safety engineering, meaning how a wrong score is handled as a safety event, is not published.

Use and disclosure commitments are stated by category, with no retention schedule.

The company holds protected health information as a covered entity and publishes the notice that position requires. Because the test is delivered through its CLIA certified laboratory, Artera receives protected health information from ordering providers or other laboratories directly, and the HIPAA Notice of Privacy Practices linked in the footer carries a stated effective date. It enumerates permitted uses and disclosures individually; sets out patient rights including access, amendment, confidential communications, restriction requests and a six year accounting of disclosures; commits to breach notification within sixty days; gives a named privacy contact with email, telephone and postal address; explains the complaint route to the Office for Civil Rights with an undertaking not to retaliate; requires authorization for marketing or any disclosure amounting to a sale; and states that the company's own business associates must maintain the privacy of protected health information.

Business associate terms are a separate matter. A covered entity laboratory has no business associate agreement toward the ordering practice, and none is published for any business associate role the company holds, for example toward a health system sending images for analysis under the authorized software.

On the covered entity side, the position is stated outright and the notice is complete.

A recognized attestation is named and the artifacts are on request. The security page states SOC 2 Type II, AES-256 encryption at rest, encryption in transit, regular security assessments including third party penetration tests, and AWS hosting, and it points to a trust center (trust.artera.ai) where a buyer can view controls and request documentation, including a copy of penetration test results. A vulnerability reporting route is published (security@artera.ai and a reporting page). The laboratory holds College of American Pathologists accreditation, a laboratory quality credential rather than an information security one.

The SOC 2 report and penetration test results require a request, no ISO/IEC 27001 or HITRUST certification is named, the penetration testing cadence is not stated, and no subprocessor list is published, which matters for a service that receives digitized patient specimens.

An attestation named without the artifact.

An authorization is identifiable, and which product a buyer receives decides whether it applies. FDA granted De Novo authorization DEN240068 to ArteraAI Prostate (Artera Inc.) on 31 July 2025, announced in August: product code SFH under 21 CFR 864.3755, a prescription software device that analyzes H and E whole slide images from treatment naive prostate core needle biopsies, acquired on FDA cleared interoperable scanners, to give 10 year risks of distant metastasis and prostate cancer specific mortality for men 55 and older without metastases who are candidates for curative treatment. It carries a Predetermined Change Control Plan for adding FDA cleared whole slide scanners, not for widening the indication.

The company's prostate test page states, for all three variants it sells through its own laboratory (biopsy, post prostatectomy and mHSPC), that the test is a laboratory developed test performed in its CLIA certified Jacksonville laboratory and "has not been cleared or approved by the U.S. Food and Drug Administration". The home page presents the ArteraAI Prostate Test under an FDA De Novo authorization heading beside the same three variants. Both can be true, the authorized software and the laboratory service being different routes, but the home page does not say which route a given order takes, and the post prostatectomy and mHSPC variants sit outside the authorized indication. The breast test carries no regulatory statement on the home page.

An authorization identified with its indication, with the product on offer not matched to it on the company's own pages.

A published fairness evaluation with results compared across groups, on the locked model. "Assessing Algorithmic Fairness With a Multimodal Artificial Intelligence Model in Men of African and Non-African Origin on NRG Oncology Prostate Cancer Phase III Trials" (JCO Clinical Cancer Informatics, 2025) evaluated the locked models across 5,708 patients from five randomized phase III NRG Oncology and RTOG trials, 948 (16.6 percent) of them African American. It reports prognostic performance separately for African American and non African American men, with subdistribution hazard ratios and confidence intervals for distant metastasis and prostate cancer specific mortality, and concludes the model performed comparably across the two groups; the company's home page states the same finding. Development cohorts were built at roughly 20 percent African American representation, a design decision stated in advance. An external validation in an Asian cohort in Singapore was undertaken because performance outside largely White and African American populations was lacking. The FDA's special controls for this device type require clinical validation with subgroup analysis.

What remains open is performance by age and by other ethnic groups in the United States, by scanner, and whether the fairness analysis will be repeated when the models are revised.

A patient can have the AI's result amended at the laboratory that produced it, and nothing contractual stands behind the output. Artera runs the test in its own CLIA laboratory and reports the score as the laboratory result, and its Notice of Privacy Practices (effective 21 May 2024) gives the patient the right to request an amendment of their PHI, which Artera says it will honor unless it is not the originator or believes the PHI is accurate. Artera originates the result, so the right reaches the AI's output itself. The score informs a clinician's decision and its inputs are stated (biopsy images and clinical data); the FDA authorized version (DEN240068) carries labeling that the device complements a standard of care evaluation, is not intended to determine diagnosis, and may perform worse on poor image quality or in some subpopulations. The company gives no error rate: the prostate test page reports hazard ratios for the predictive biomarker, which measure treatment benefit rather than how often the score misplaces a patient, and calibration at the cut points with event counts is absent too. No warranty, indemnity or remediation commitment is published.

The route to a correction is real, and nothing in a contract backs it.

No integration evidence. Ordering and result delivery run through the company's own portal, with no electronic health record, laboratory information system, digital pathology platform or interface standard such as HL7 or FHIR named. For a test meant to inform a treatment decision at a specific point in a care pathway, a result arriving outside the record the clinician works in adds a manual step and a place for the result to be missed or delayed. The FDA authorized software version (DEN240068) takes whole slide images from FDA cleared interoperable scanners, which is scanner interoperability rather than record integration.

Nothing is installed, and the hosting is named without a committed location. The test is performed by ArteraAI's CLIA certified, CAP accredited laboratory at 6800 Southpoint Parkway, Jacksonville, Florida: a provider sends digitized slide images with clinical data and receives results through the company's ordering portal, and the test consumes no tissue because it reads existing slides. The security page says the service runs on AWS "to ensure data sovereignty and security across multiple regions", with AES-256 encryption at rest; it names no region and makes no residency commitment, and nothing states whether any processing takes place outside the United States.

A single hosted service with location implied by a United States laboratory rather than committed.

No price is published, and how the test is paid for can be established. The home page says the test is fully reimbursed for Medicare patients and that many commercial health plans provide coverage, with a billing page linked, and CMS coverage is in place with a payment rate effective January 2024. Those figures are what payers pay the laboratory, not a price the ordering practice or patient can compare; the company's own charge is not published, and patient responsibility under commercial plans is left to the billing page and the No Surprises Act notice in the footer. An independent cost effectiveness analysis of the test for guiding androgen deprivation therapy in intermediate risk prostate cancer was published in a JNCI journal in March 2026 by a UCLA group, which is outside economic evidence rather than a price.

The reimbursement route is discoverable and no figure of the company's own is published.

Coverage is deliberately narrow and named, with validation behind the biopsy test and less shown for the newer tests. The authorized software covers treatment naive prostate core needle biopsies from men 55 and older without metastases who are candidates for curative treatment, on H and E slides from FDA cleared interoperable scanners; the laboratory test adds post prostatectomy biochemical recurrence and metastatic hormone sensitive prostate cancer, and a breast cancer test is also sold. The biopsy test's coverage rests on validation in NRG Oncology and RTOG phase 3 trials, an external Singapore cohort and a real world prostatectomy cohort, and post prostatectomy validation in NRG/RTOG cohorts is published. The company's home page and prostate test page describe the mHSPC test (June 2026) and the breast test without comparable validation, and do not list the scanners validated for the authorized software, whose change control plan exists to add more.

Narrowness is not the limitation: depth in one disease is what produced guideline inclusion. The limitation is that validation covers only part of what is sold.